Subject the GoldenPipeline itself to cdk-nag scanning

I started playing around with adding `cdk-nag` to the GoldenPipeline app.

... predictably, it found stuff right away.

As for adding this check so that it is settable at synth/deploy time, I think we can selectively activate the checks based on a context value (?).

My experience with `cdk-nag` is that it is far quicker to run it (and weep) than it is to fix things that it finds (which take investigation, adjustment, and mucking with IAM policies/roles almost every time).

Start by locating the GoldenPipeline app and reviewing how synthesis and deployment are invoked. Determine how cdk-nag checks could be selectively enabled through a context value, then identify the findings and IAM-related adjustments needed for the scan to pass.

Written by the indexing model from the issue text.